CVE-2022-41716

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/446916	Patch Vendor Advisory
https://go.dev/issue/56284	Issue Tracking Patch Vendor Advisory
https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ	Patch Release Notes Vendor Advisory
https://pkg.go.dev/vuln/GO-2022-1095	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

27 Jun 2023, 14:39

Type	Values Removed	Values Added
CWE	~~CWE-74~~	NVD-CWE-Other

04 Nov 2022, 13:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CWE		CWE-74
CPE		cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:golang:go::::::::
References	~~(MISC) https://go.dev/issue/56284 -~~	(MISC) https://go.dev/issue/56284 - Issue Tracking, Patch, Vendor Advisory
References	~~(MISC) https://pkg.go.dev/vuln/GO-2022-1095 -~~	(MISC) https://pkg.go.dev/vuln/GO-2022-1095 - Vendor Advisory
References	~~(MISC) https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ -~~	(MISC) https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ - Patch, Release Notes, Vendor Advisory
References	~~(MISC) https://go.dev/cl/446916 -~~	(MISC) https://go.dev/cl/446916 - Patch, Vendor Advisory

02 Nov 2022, 16:55

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-11-02 16:15

Updated : 2024-10-30 14:35

NVD link : CVE-2022-41716

Mitre link : CVE-2022-41716

CVE.ORG link : CVE-2022-41716

JSON object : View

Products Affected

microsoft

windows

golang

go

CWE

NVD-CWE-Other

{"id": "CVE-2022-41716", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2022-11-02T16:15:11.150", "references": [{"url": "https://go.dev/cl/446916", "tags": ["Patch", "Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/56284", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2022-1095", "tags": ["Vendor Advisory"], "source": "security@golang.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string \"A=B\\x00C=D\" sets the variables \"A=B\" and \"C=D\"."}, {"lang": "es", "value": "Debido a valores NUL no sanitizados, los atacantes pueden configurar variables de entorno de forma maliciosa en Windows. En syscall.StartProcess y os/exec.Cmd, los valores de variables de entorno no v\u00e1lidos que contienen valores NUL no se verifican correctamente. Un valor de variable de entorno malicioso puede aprovechar este comportamiento para establecer un valor para una variable de entorno diferente. Por ejemplo, la cadena de variable de entorno \"A=B\\x00C=D\" establece las variables \"A=B\" y \"C=D\"."}], "lastModified": "2024-10-30T14:35:05.003", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38EFB36B-50AE-41B5-A036-EBE041702AF7", "versionEndExcluding": "1.18.8"}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3E7F5D0-6DE2-4D7E-AF0A-04C4BE7F512D", "versionEndExcluding": "1.19.3", "versionStartIncluding": "1.19.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@golang.org"}